A backup tunnel has compatible SAs and a selected remote-subnet route, but no accepting policy permits LAN traffic through its interface. What blocks useful failover?

Choose the single best answer.

A.The absence of a route description.
B.The fact that the primary uses a different tunnel name.
C.Missing forwarding authorization for the selected backup path.
D.Insufficient strength of the already compatible PSK alone.

Show the answer and explanation

✓ Correct answer

Missing forwarding authorization for the selected backup path.

A route and SA do not grant permission. The actual backup egress must be covered by accepting policy, directly or through a correct zone design. Strengthening compatible keying, adding descriptions or matching names does not repair that permission gap.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.